Improving and Scaling Security Operations Automation and Orchestration using Predictive Machine Learning

安全运营中心(SOC)是打击和确保各种规模的组织做好应对网络攻击准备的重要平台。尽管SOC很受欢迎，但由于每天观察到的IT基础设施和安全数据和事件的数量、速度和多样性不断增长，SOC面临着越来越大的挑战和压力。由于入侵检测系统(入侵检测系统)和安全信息和事件管理(SIEM)等当前技术解决方案的性能参差不齐，因此过度依赖人类安全分析员对事件的人工分析。这会造成大量积压，并大大减慢关键安全事件的解决速度。拟议的国际合作的目的是开发下一代安全自动化平台，该平台将提高SOC工作流程以及基本流程和任务的效力和效率。拟议中的合作将通过加强对数字资产和关键基础设施的保护，并通过提高两国网络安全行业的竞争力，使加拿大和美国受益。

Security Operation Centers (SOCs) are essential platforms in combating and ensuring the readiness of organizations of all size against cyberattacks. Despite their popularity, SOCs are facing increasing challenges and pressure due to the growing volume, velocity and variety of the IT infrastructure and security data and events observed daily. Due to the mixed performance of current technological solutions, e.g., intrusion detection system (IDS) and security information and event management (SIEM), there is an over-reliance on manual analysis of the events by human security analysts. This creates huge backlogs and slows down considerably the resolution of critical security events. The purpose of the proposed international collaboration is to develop the next generation security automation platform that will increase the effectiveness and efficiency of the SOC workflow and underlying processes and tasks. The proposed collaboration will benefit Canada and the USA by strengthening the protection of digital assets and critical infrastructure and by increasing the competitiveness of their cybersecurity industry.